OneNote File Extraction, (Sun, Nov 1st)
Summary
The author describes a recent need to extract embedded files from OneNote files with the .one extension. This process was undertaken to investigate the contents of these embedded files.
IFF Assessment
FOE
The ability to extract embedded files from OneNote could be abused by attackers to hide malicious payloads, making it a concern for defenders.
Defender Context
This technique highlights the potential for attackers to use seemingly benign document formats like OneNote to conceal and deliver malware. Defenders should be aware of file types that can embed other content and ensure their security solutions can inspect these embedded objects for malicious activity.